Fallos del tipo CWE-20

5418 resultados

Validação inadequada de entrada

A aplicação recebe dados de fontes externas (usuário, API, arquivo) sem verificar se estão no formato, tamanho ou tipo esperado antes de usá-los. Isso permite que um atacante envie dados malformados ou maliciosos que podem causar erros, corrupção de dados, execução de código ou acesso não autorizado.

Ejemplo

Um formulário que aceita um número de idade sem validar se é um inteiro positivo entre 0 e 150. Um atacante envia idade=-5 ou idade='DROP TABLE users;' via SQL, e o código processa isso diretamente no banco sem sanitização, causando dano.

Cómo mitigar

Valide TODA entrada externa: verificar tipo, tamanho, formato e intervalo permitido antes de usar. Use whitelists (aceitar apenas valores conhecidos como seguros) em vez de blacklists, e aplique sanitização ou prepared statements para dados que vão em queries. Testes de entrada fuzzing também ajudam a encontrar gaps.

CVE-2023-27601HIGHOpenSIPS has vulnerability in the codec_delete_XX() functionsEPSS 1.0%CVE-2023-27600HIGHOpenSIPS has vulnerability in the codec_delete_XX() functionsEPSS 1.0%CVE-2022-26106—When a user opens a manipulated Computer Graphics Metafile (.cgm, CgmCore.dll) received from untrusted sources in SAP 3D Visual Enterprise VEPSS 1.0%CVE-2022-26109—When a user opens a manipulated Portable Document Format (.pdf, PDFView.x3d) received from untrusted sources in SAP 3D Visual Enterprise VieEPSS 1.0%CVE-2019-5461—An input validation problem was discovered in the GitHub service integration which could result in an attacker being able to make arbitrary EPSS 1.0%CVE-2022-26107—When a user opens a manipulated Jupiter Tesselation (.jt, JTReader.x3d) received from untrusted sources in SAP 3D Visual Enterprise Viewer -EPSS 1.0%CVE-2026-48055CRITICALStreambert: Arbitrary File Write (Zip Slip) via Subtitle ExtractionEPSS 1.0%CVE-2025-8266MEDIUMyanyutao0402 ChanCMS collect.js getArticle deserializationEPSS 1.0%CVE-2018-0196—A vulnerability in the web-based user interface (web UI) of Cisco IOS XE Software could allow an authenticated, remote attacker to write arbEPSS 1.0%CVE-2023-1888HIGHDirectorist <= 7.5.4 - Authenticated (Subscriber+) Arbitrary User Password Reset to Privilege EscalationEPSS 1.0%CVE-2026-32201MEDIUMMicrosoft SharePoint Server Spoofing VulnerabilityEPSS 1.0%KEVCVE-2023-29195MEDIUMVitess VTAdmin users that can create shards can deny access to other functionsEPSS 1.0%CVE-2023-32323MEDIUMSynapse Outgoing federation to specific hosts can be disabled by sending malicious invitesEPSS 1.0%CVE-2023-28955MEDIUMIBM Watson Knowledge Catalog denial of serviceEPSS 1.0%CVE-2023-20072HIGHCisco IOS XE Software Fragmented Tunnel Protocol Packet Denial of Service VulnerabilityEPSS 1.0%CVE-2021-34570HIGHPhoenix Contact: DoS for PLCnext Control devices in versions prior to 2021.0.5 LTSEPSS 1.0%CVE-2021-22699—Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that could cause denial of EPSS 1.0%CVE-2025-14213HIGHCato's Socket WebUI is vulnerable to OS Command InjectionEPSS 1.0%CVE-2021-4219—A flaw was found in ImageMagick. The vulnerability occurs due to improper use of open functions and leads to a denial of service. This flaw EPSS 1.0%CVE-2021-20252—A flaw was found in Red Hat 3scale API Management Platform 2. The 3scale backend does not perform preventive handling on user-requested dateEPSS 1.0%